To quote Timour review lines:

The actual cause of the bug is that sql_base.cc:setup_wild()
sets "select_lex->with_wild = 0" (in the end of the function) once
it expands all wild-cards, and wild-card expansion is done during
the prepare phase. During this phase we replace all "*" with the
corresponding items, which for views happen to be references to
references. When we do execute, select_lex->with_wild = 0, and
all "*" are already replaced by the corresponding items, which
in the case of views need to be dereferenced first.

Fixed by refining the assert. Regression test for the bug is rpl_row_view01,
as was reported.

into  mysql.com:/home/jimw/my/mysql-5.0-clean

into  snake-hub.snake.net:/src/extern/MySQL/bk/mysql-5.0

  Tweak --check-upgrade help text.

into moonbone.local:/work/15706-bug-5.0-mysql

into mysql.com:/home/hf/work/mysql-5.0.w2645

necessary implementation in the server
mysql_upgrade script added

into  mysql.com:/home/mydev/mysql-5.0-bug8841

  Fix out of order options.

into  mysql.com:/home/mydev/mysql-5.0-bug8841

into  neptunus.(none):/home/msvensson/mysql/mysql-5.0

into  mysql.com:/home/mydev/mysql-5.0-bug8841

into  mysql.com:/home/mydev/mysql-5.0-bug8841

into  mysql.com:/home/stewart/Documents/MySQL/5.0/bug17411-thisisaverylongnamethatshouldbewaylongerthanthe128limitthatweprivouslyhadbutireallywantotestitandseethatitdoesreallywork.nowitshouldbeabout160charslongnonow.iwonderifanythingwillchokeornotwiththisoutrageouslylongpathname

into  neptunus.(none):/home/msvensson/mysql/mysql-5.0

into  mysql.com:/home/jimw/my/mysql-5.0-clean

into  mysql.com:/home/jimw/my/mysql-5.0-clean

If item->cached_table is set, find_field_in_tables() returns found field
even if it doesn't belong to current select. Because Item_field::fix_fields
doesn't expect such behaviour, reported bug occurs.

Item_field::fix_fields() was modifed to detect when find_field_in_tables() 
can return field from outer select and process such fields accordingly.
In order to ease this code which was searching and processing outed fields was
moved into separate function called Item_field::fix_outer_field().

into  mysql.com:/home/jimw/my/mysql-4.1-clean

 - Init sql_state in mysql_stmt_init

into  neptunus.(none):/home/msvensson/mysql/mysql-5.0

into  neptunus.(none):/home/msvensson/mysql/mysql-5.0

Use the POSIX limits.h define of PATH_MAX for maximum path length.

This has been being hit in pushbuild

into  mysql.com:/home/jimw/my/mysql-5.0-clean

into  mysql.com:/home/jimw/my/mysql-4.1-clean

into  mysql.com:/usr_rh9/home/elkin.rh9/MySQL/Merge/5.0

into  mysql.com:/usr_rh9/home/elkin.rh9/MySQL/BARE/mysql-5.0

into moonbone.local:/work/16272-bug-5.0-mysql

into  neptunus.(none):/home/msvensson/mysql/mysql-5.0

into  neptunus.(none):/home/msvensson/mysql/mysql-5.0

into  neptunus.(none):/home/msvensson/mysql/mysql-5.0

into  mysql.com:/usr_rh9/home/elkin.rh9/MySQL/BARE/mysql-5.0

The Item_func_if::fix_length_and_dec() function when calculating length of 
result doesn't take into account unsigned_flag. But it is taken when 
calculating length of temporary field. This result in creating field that 
shorter than needed. Due to this, in the reported query 40.0 converted to 9.99.

The function Item_func_if::fix_length_and_dec() now adds 1 to the max_length if 
the unsigned_flag isn't set.

into  mysql.com:/usr_rh9/home/elkin.rh9/MySQL/Merge/5.0

into  mysql.com:/usr_rh9/home/elkin.rh9/MySQL/BARE/mysql-5.0